Every verdict explains itself
Every verdict explains itself
A verdict is permit or deny, with a trace: the layer that decided, a reason where the layer has one, what it is attributed to, and typed findings. Identical inputs give identical verdicts and traces.
A verdict is permit or deny, with a trace: the layer that decided, a reason where the layer has one, what it is attributed to, and typed findings. Identical inputs give identical verdicts and traces.
Two traces, sketched
Two traces, sketched
Input · a friend's note reaches the feed
Input · a friend's note reaches the feed
verdict      permit
layer        permission
attribution  carrier  <parent A, sealed>
             label    "school friends"
             list     30000:<guardian>:classmates
qualifying   1 permission  "school friends"
hits         2 extension   via curator <school>
walls        <note id>: deny — author denied
findings     age — construct 26 h old
verdict permitlayer permissionattribution carrier <parent A, sealed>label "school friends"list 30000:<guardian>:classmatesqualifying 1 permission "school friends"hits 2 extension via curator <school>walls <note id>: deny — author deniedfindings age — construct 26 h old
Output · the subject's reply is refused
Output · the subject's reply is refused
verdict      deny
layer        unmatched
element      ["p", "<X>"] — first uncovered
findings     sweep-incomplete: unresolved
             (a branch beyond layer 0)
verdict denylayer unmatchedelement ["p", "<X>"] — first uncoveredfindings sweep-incomplete: unresolved(a branch beyond layer 0)
Illustrative, not the wire format: the field shapes belong to the conformance documents. What is fixed is the vocabulary — and the obligation to name what decided.
Illustrative, not the wire format: the field shapes belong to the conformance documents. What is fixed is thevocabulary — and the obligation to name what decided.
Fifteen layers — the closed set
Fifteen layers — the closed set
guardian
guardian
an implied guardian entry admitted it
an implied guardian entry admitted it
permission
permission
a guardian's own grant admitted it
a guardian's own grant admitted it
extension
extension
a harvested grant admitted it — with provenance
a harvested grant admitted it — with provenance
self
self
the subject's own event
the subject's own event
kind0
kind0
a profile event, legible by rule
a profile event, legible by rule
covered
covered
output: everything it names is covered
output: everything it names is covered
global
global
the global set said no
the global set said no
blocklist
blocklist
a deny gate matched
a deny gate matched
unmatched
unmatched
nothing admitted it · something is uncovered
nothing admitted it · something is uncovered
unverifiable
unverifiable
it failed verification
it failed verification
unresolved
unresolved
output: something named did not resolve
output: something named did not resolve
opaque
opaque
output: encrypted and not reducible
output: encrypted and not reducible
destination
destination
output: a destination was refused
output: a destination was refused
unbound
unbound
no valid association
no valid association
refusal
refusal
the assembly refused
the assembly refused
Reasons ride with three layers — unbound (absent, invalid), refusal (regression, malformed, cap, guardian-denied) and unmatched (opaque, no-offer).
Reasons ride with three layers — unbound (absent, invalid), refusal (regression, malformed,cap, guardian-denied) and unmatched (opaque, no-offer).
Determinism
Determinism
Identical
(construct, event, direction,
instant, world, inputs)
give identical verdicts, traces and orderings — across runs and across implementations.

The engine reads no ambient clock: the instant is supplied. No randomness, map order or wall clock shows in any output — ciphertext alone excepted.
Identical(construct, event, direction,instant, world, inputs)give identical verdicts, traces and orderings — across runs and acrossimplementations.The engine reads no ambient clock: the instant is supplied. No randomness,map order or wall clock shows in any output — ciphertext alone excepted.
Findings
Findings
Every drop, skip, truncation or failed load emits a typed finding, bar a few stated exceptions —
unloaded · age · unenforced · sweep-incomplete · mutation · harvest-denied …
A missing finding where one is due is a conformance failure.
Every drop, skip, truncation or failed load emits a typed finding, bar a fewstated exceptions —unloaded · age · unenforced · sweep-incomplete · mutation · harvest-denied …A missing finding where one is due is a conformance failure.
What never leaves the locus
What never leaves the locus
Recovered plaintext is never stored, logged or published. Findings derived from reduction and the reduction record stay at the locus; a trace naming a correspondent never reaches a monitor relay.
Recovered plaintext is never stored, logged or published. Findings derived fromreduction and the reduction record stay at the locus; a trace naming acorrespondent never reaches a monitor relay.
Why it matters
So the subject can ask well — see who an unknown person is, which permission decided, and exactly what a refusal lacks — and so that when something reaches the feed that should not have, a guardian knows every permission it stood on, and where to act.
Why it mattersSo the subject can ask well — see who an unknown person is, which permission decided, and exactly what a refusal lacks — and so that when something reaches the feed that should not have, a guardian knows every permission it stood on, and where to act.
TEPP Zeta · diagram 16 · statements: TRACE-001–TRACE-073, INTRO-002–INTRO-005, IN-031, OUT-039, OPQ-052–OPQ-056, CONS-117, CONS-118
TEPP Zeta · diagram 16 · statements: TRACE-001–TRACE-073, INTRO-002–INTRO-005, IN-031, OUT-039, OPQ-052–OPQ-056, CONS-117, CONS-118